This commit is contained in:
Martin Willi
@@ -1 +0,0 @@
|
|||||||
_keycensor
|
|
||||||
@@ -1,43 +0,0 @@
|
|||||||
# Makefile for miscelaneous programs
|
|
||||||
# Copyright (C) 2002 Michael Richardson <[email protected]>
|
|
||||||
#
|
|
||||||
# This program is free software; you can redistribute it and/or modify it
|
|
||||||
# under the terms of the GNU General Public License as published by the
|
|
||||||
# Free Software Foundation; either version 2 of the License, or (at your
|
|
||||||
# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
|
||||||
#
|
|
||||||
# This program is distributed in the hope that it will be useful, but
|
|
||||||
# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
|
||||||
# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
|
||||||
# for more details.
|
|
||||||
#
|
|
||||||
# RCSID $Id: Makefile,v 1.1 2004/03/15 20:35:27 as Exp $
|
|
||||||
|
|
||||||
FREESWANSRCDIR=../..
|
|
||||||
include ${FREESWANSRCDIR}/Makefile.inc
|
|
||||||
|
|
||||||
PROGRAM=_keycensor
|
|
||||||
PROGRAMDIR=${LIBDIR}
|
|
||||||
|
|
||||||
include ../Makefile.program
|
|
||||||
|
|
||||||
#
|
|
||||||
# $Log: Makefile,v $
|
|
||||||
# Revision 1.1 2004/03/15 20:35:27 as
|
|
||||||
# added files from freeswan-2.04-x509-1.5.3
|
|
||||||
#
|
|
||||||
# Revision 1.3 2002/08/02 16:01:15 mcr
|
|
||||||
# moved user visible programs to $PREFIX/libexec, while moving
|
|
||||||
# private files to $PREFIX/lib.
|
|
||||||
#
|
|
||||||
# Revision 1.2 2002/06/02 22:02:14 mcr
|
|
||||||
# changed TOPDIR->FREESWANSRCDIR in all Makefiles.
|
|
||||||
# (note that linux/net/ipsec/Makefile uses TOPDIR because this is the
|
|
||||||
# kernel sense.)
|
|
||||||
#
|
|
||||||
# Revision 1.1 2002/04/24 07:55:32 mcr
|
|
||||||
# #include patches and Makefiles for post-reorg compilation.
|
|
||||||
#
|
|
||||||
#
|
|
||||||
#
|
|
||||||
|
|
||||||
@@ -1,33 +0,0 @@
|
|||||||
.TH _KEYCENSOR 8 "25 Apr 2002"
|
|
||||||
.\"
|
|
||||||
.\" RCSID $Id: _keycensor.8,v 1.1 2004/03/15 20:35:27 as Exp $
|
|
||||||
.\"
|
|
||||||
.SH NAME
|
|
||||||
ipsec _keycensor \- internal routine to remove sensitive information
|
|
||||||
.SH DESCRIPTION
|
|
||||||
.I _keycensor
|
|
||||||
is used by
|
|
||||||
.B ipsec barf
|
|
||||||
to process the /etc/ipsec.secrets file, removing private key info.
|
|
||||||
.SH "SEE ALSO"
|
|
||||||
ipsec(8), ipsec_barf(8)
|
|
||||||
.SH HISTORY
|
|
||||||
Man page written for the Linux FreeS/WAN project <http://www.freeswan.org/>
|
|
||||||
by Michael Richardson. Original program by Henry Spencer.
|
|
||||||
.\"
|
|
||||||
.\" $Log: _keycensor.8,v $
|
|
||||||
.\" Revision 1.1 2004/03/15 20:35:27 as
|
|
||||||
.\" added files from freeswan-2.04-x509-1.5.3
|
|
||||||
.\"
|
|
||||||
.\" Revision 1.2 2002/04/29 22:39:31 mcr
|
|
||||||
.\" added basic man page for all internal commands.
|
|
||||||
.\"
|
|
||||||
.\" Revision 1.1 2002/04/26 01:21:43 mcr
|
|
||||||
.\" while tracking down a missing (not installed) /etc/ipsec.conf,
|
|
||||||
.\" MCR has decided that it is not okay for each program subdir to have
|
|
||||||
.\" some subset (determined with -f) of possible files.
|
|
||||||
.\" Each subdir that defines $PROGRAM, MUST have a PROGRAM.8 file as well as a PROGRAM file.
|
|
||||||
.\" Optional PROGRAM.5 files have been added to the makefiles.
|
|
||||||
.\"
|
|
||||||
.\"
|
|
||||||
.\"
|
|
||||||
@@ -1,52 +0,0 @@
|
|||||||
#! /bin/sh
|
|
||||||
# implements key censoring for barf
|
|
||||||
# Copyright (C) 1999, 2002 Henry Spencer.
|
|
||||||
#
|
|
||||||
# This program is free software; you can redistribute it and/or modify it
|
|
||||||
# under the terms of the GNU General Public License as published by the
|
|
||||||
# Free Software Foundation; either version 2 of the License, or (at your
|
|
||||||
# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
|
||||||
#
|
|
||||||
# This program is distributed in the hope that it will be useful, but
|
|
||||||
# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
|
||||||
# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
|
||||||
# for more details.
|
|
||||||
#
|
|
||||||
# RCSID $Id: _keycensor.in,v 1.1 2004/03/15 20:35:27 as Exp $
|
|
||||||
|
|
||||||
usage="Usage: $0 [file ...]"
|
|
||||||
me="ipsec _keycensor"
|
|
||||||
|
|
||||||
for dummy
|
|
||||||
do
|
|
||||||
case "$1" in
|
|
||||||
--help) echo "$usage" ; exit 0 ;;
|
|
||||||
--version) echo "$me $IPSEC_VERSION" ; exit 0 ;;
|
|
||||||
--) shift ; break ;;
|
|
||||||
-*) echo "$0: unknown option \`$1'" >&2 ; exit 2 ;;
|
|
||||||
*) break ;;
|
|
||||||
esac
|
|
||||||
shift
|
|
||||||
done
|
|
||||||
|
|
||||||
awk ' /(sig|enc|auth)key[ \t]*=[ \t]*[^%]/ {
|
|
||||||
i = match($0, /key[ \t]*=[ \t]*/)
|
|
||||||
i += RLENGTH
|
|
||||||
cold = substr($0, 1, i-1)
|
|
||||||
hot = substr($0, i)
|
|
||||||
sub(/[ \t]+(#.*)?$/, "", hot)
|
|
||||||
q = "'"'"'" # single quote
|
|
||||||
if (hot ~ q)
|
|
||||||
cooled = "[cannot be condensed]"
|
|
||||||
else if (hot ~ /^0s/)
|
|
||||||
cooled = "[keyid " substr(hot, 3, 9) "]"
|
|
||||||
else {
|
|
||||||
run = "echo " q hot q " | md5sum"
|
|
||||||
run | getline
|
|
||||||
close(run)
|
|
||||||
cooled = "[sums to " substr($1, 1, 4) "...]"
|
|
||||||
}
|
|
||||||
print cold cooled
|
|
||||||
next
|
|
||||||
}
|
|
||||||
{ print }' $*
|
|
||||||
@@ -1 +0,0 @@
|
|||||||
_secretcensor
|
|
||||||
@@ -1,43 +0,0 @@
|
|||||||
# Makefile for miscelaneous programs
|
|
||||||
# Copyright (C) 2002 Michael Richardson <[email protected]>
|
|
||||||
#
|
|
||||||
# This program is free software; you can redistribute it and/or modify it
|
|
||||||
# under the terms of the GNU General Public License as published by the
|
|
||||||
# Free Software Foundation; either version 2 of the License, or (at your
|
|
||||||
# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
|
||||||
#
|
|
||||||
# This program is distributed in the hope that it will be useful, but
|
|
||||||
# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
|
||||||
# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
|
||||||
# for more details.
|
|
||||||
#
|
|
||||||
# RCSID $Id: Makefile,v 1.1 2004/03/15 20:35:27 as Exp $
|
|
||||||
|
|
||||||
FREESWANSRCDIR=../..
|
|
||||||
include ${FREESWANSRCDIR}/Makefile.inc
|
|
||||||
|
|
||||||
PROGRAM=_secretcensor
|
|
||||||
PROGRAMDIR=${LIBDIR}
|
|
||||||
|
|
||||||
include ../Makefile.program
|
|
||||||
|
|
||||||
#
|
|
||||||
# $Log: Makefile,v $
|
|
||||||
# Revision 1.1 2004/03/15 20:35:27 as
|
|
||||||
# added files from freeswan-2.04-x509-1.5.3
|
|
||||||
#
|
|
||||||
# Revision 1.3 2002/08/02 16:01:38 mcr
|
|
||||||
# moved user visible programs to $PREFIX/libexec, while moving
|
|
||||||
# private files to $PREFIX/lib.
|
|
||||||
#
|
|
||||||
# Revision 1.2 2002/06/02 22:02:14 mcr
|
|
||||||
# changed TOPDIR->FREESWANSRCDIR in all Makefiles.
|
|
||||||
# (note that linux/net/ipsec/Makefile uses TOPDIR because this is the
|
|
||||||
# kernel sense.)
|
|
||||||
#
|
|
||||||
# Revision 1.1 2002/04/24 07:55:32 mcr
|
|
||||||
# #include patches and Makefiles for post-reorg compilation.
|
|
||||||
#
|
|
||||||
#
|
|
||||||
#
|
|
||||||
|
|
||||||
@@ -1,34 +0,0 @@
|
|||||||
.TH _SECRETCENSOR 8 "25 Apr 2002"
|
|
||||||
.\"
|
|
||||||
.\" RCSID $Id: _secretcensor.8,v 1.1 2004/03/15 20:35:27 as Exp $
|
|
||||||
.\"
|
|
||||||
.SH NAME
|
|
||||||
ipsec _secretcensor \- internal routing to sanitize files
|
|
||||||
.SH DESCRIPTION
|
|
||||||
.I _secretcensor
|
|
||||||
is called by
|
|
||||||
.B ipsec barf
|
|
||||||
to process the /etc/ipsec.secrets file to remove the private key components
|
|
||||||
from the file prior to revealing the contents.
|
|
||||||
.SH "SEE ALSO"
|
|
||||||
ipsec(8), ipsec_barf(8).
|
|
||||||
.SH HISTORY
|
|
||||||
Man page written for the Linux FreeS/WAN project <http://www.freeswan.org/>
|
|
||||||
by Michael Richardson. Original program by Henry Spencer.
|
|
||||||
.\"
|
|
||||||
.\" $Log: _secretcensor.8,v $
|
|
||||||
.\" Revision 1.1 2004/03/15 20:35:27 as
|
|
||||||
.\" added files from freeswan-2.04-x509-1.5.3
|
|
||||||
.\"
|
|
||||||
.\" Revision 1.2 2002/04/29 22:39:31 mcr
|
|
||||||
.\" added basic man page for all internal commands.
|
|
||||||
.\"
|
|
||||||
.\" Revision 1.1 2002/04/26 01:21:43 mcr
|
|
||||||
.\" while tracking down a missing (not installed) /etc/ipsec.conf,
|
|
||||||
.\" MCR has decided that it is not okay for each program subdir to have
|
|
||||||
.\" some subset (determined with -f) of possible files.
|
|
||||||
.\" Each subdir that defines $PROGRAM, MUST have a PROGRAM.8 file as well as a PROGRAM file.
|
|
||||||
.\" Optional PROGRAM.5 files have been added to the makefiles.
|
|
||||||
.\"
|
|
||||||
.\"
|
|
||||||
.\"
|
|
||||||
@@ -1,75 +0,0 @@
|
|||||||
#! /bin/sh
|
|
||||||
# implements secret censoring for barf
|
|
||||||
# Copyright (C) 1999 Henry Spencer.
|
|
||||||
#
|
|
||||||
# This program is free software; you can redistribute it and/or modify it
|
|
||||||
# under the terms of the GNU General Public License as published by the
|
|
||||||
# Free Software Foundation; either version 2 of the License, or (at your
|
|
||||||
# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
|
||||||
#
|
|
||||||
# This program is distributed in the hope that it will be useful, but
|
|
||||||
# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
|
||||||
# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
|
||||||
# for more details.
|
|
||||||
#
|
|
||||||
# RCSID $Id: _secretcensor.in,v 1.1 2004/03/15 20:35:27 as Exp $
|
|
||||||
|
|
||||||
usage="Usage: $0 [file ...]"
|
|
||||||
me="ipsec _secretcensor"
|
|
||||||
|
|
||||||
for dummy
|
|
||||||
do
|
|
||||||
case "$1" in
|
|
||||||
--help) echo "$usage" ; exit 0 ;;
|
|
||||||
--version) echo "$me $IPSEC_VERSION" ; exit 0 ;;
|
|
||||||
--) shift ; break ;;
|
|
||||||
-*) echo "$0: unknown option \`$1'" >&2 ; exit 2 ;;
|
|
||||||
*) break ;;
|
|
||||||
esac
|
|
||||||
shift
|
|
||||||
done
|
|
||||||
|
|
||||||
awk ' function cool(hot, q, cooled, run) {
|
|
||||||
# warning: may destroy input line!
|
|
||||||
q = "'"'"'" # single quote
|
|
||||||
if (hot ~ q)
|
|
||||||
return "[cannot be summed]"
|
|
||||||
if (hot ~ /^0s/)
|
|
||||||
return "[keyid " substr(hot, 3, 9) "]"
|
|
||||||
run = "echo " q hot q " | md5sum"
|
|
||||||
run | getline
|
|
||||||
close(run)
|
|
||||||
return "[sums to " substr($1, 1, 4) "...]"
|
|
||||||
}
|
|
||||||
/"/ {
|
|
||||||
i = match($0, /"[^"]+"/)
|
|
||||||
cold1 = substr($0, 1, i)
|
|
||||||
cold2 = substr($0, i+RLENGTH-1)
|
|
||||||
hot = substr($0, i+1, RLENGTH-2)
|
|
||||||
print cold1 cool(hot) cold2
|
|
||||||
next
|
|
||||||
}
|
|
||||||
/#pubkey=/ {
|
|
||||||
i = match($0, /^.*#pubkey=/)
|
|
||||||
i += RLENGTH-1
|
|
||||||
cold = substr($0, 1, i)
|
|
||||||
hot = substr($0, i+1)
|
|
||||||
print cold cool(hot)
|
|
||||||
next
|
|
||||||
}
|
|
||||||
/#IN KEY / {
|
|
||||||
i = match($0, /^.*[ \t][^ \t]/)
|
|
||||||
i += RLENGTH-2
|
|
||||||
cold = substr($0, 1, i)
|
|
||||||
hot = substr($0, i+1)
|
|
||||||
print cold cool("0s" hot)
|
|
||||||
next
|
|
||||||
}
|
|
||||||
/^[ \t]+(Modulus|P[a-z]+Exponent|Prime[12]|Exponent[12]|Coefficient):/ {
|
|
||||||
i = match($0, /^[^:]*:[ \t]*/)
|
|
||||||
i += RLENGTH-1
|
|
||||||
cold = substr($0, 1, i)
|
|
||||||
print cold "[...]"
|
|
||||||
next
|
|
||||||
}
|
|
||||||
{ print }' $*
|
|
||||||
@@ -1 +0,0 @@
|
|||||||
barf
|
|
||||||
@@ -1,38 +0,0 @@
|
|||||||
# Makefile for miscelaneous programs
|
|
||||||
# Copyright (C) 2002 Michael Richardson <[email protected]>
|
|
||||||
#
|
|
||||||
# This program is free software; you can redistribute it and/or modify it
|
|
||||||
# under the terms of the GNU General Public License as published by the
|
|
||||||
# Free Software Foundation; either version 2 of the License, or (at your
|
|
||||||
# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
|
||||||
#
|
|
||||||
# This program is distributed in the hope that it will be useful, but
|
|
||||||
# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
|
||||||
# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
|
||||||
# for more details.
|
|
||||||
#
|
|
||||||
# RCSID $Id: Makefile,v 1.1 2004/03/15 20:35:27 as Exp $
|
|
||||||
|
|
||||||
FREESWANSRCDIR=../..
|
|
||||||
include ${FREESWANSRCDIR}/Makefile.inc
|
|
||||||
|
|
||||||
PROGRAM=barf
|
|
||||||
|
|
||||||
include ../Makefile.program
|
|
||||||
|
|
||||||
#
|
|
||||||
# $Log: Makefile,v $
|
|
||||||
# Revision 1.1 2004/03/15 20:35:27 as
|
|
||||||
# added files from freeswan-2.04-x509-1.5.3
|
|
||||||
#
|
|
||||||
# Revision 1.2 2002/06/02 22:02:14 mcr
|
|
||||||
# changed TOPDIR->FREESWANSRCDIR in all Makefiles.
|
|
||||||
# (note that linux/net/ipsec/Makefile uses TOPDIR because this is the
|
|
||||||
# kernel sense.)
|
|
||||||
#
|
|
||||||
# Revision 1.1 2002/04/24 07:55:32 mcr
|
|
||||||
# #include patches and Makefiles for post-reorg compilation.
|
|
||||||
#
|
|
||||||
#
|
|
||||||
#
|
|
||||||
|
|
||||||
@@ -1,84 +0,0 @@
|
|||||||
.TH IPSEC_BARF 8 "17 March 2002"
|
|
||||||
.\" RCSID $Id: barf.8,v 1.1 2004/03/15 20:35:27 as Exp $
|
|
||||||
.SH NAME
|
|
||||||
ipsec barf \- spew out collected IPsec debugging information
|
|
||||||
.SH SYNOPSIS
|
|
||||||
.B ipsec
|
|
||||||
.B barf
|
|
||||||
[
|
|
||||||
.B \-\-short
|
|
||||||
]
|
|
||||||
.sp
|
|
||||||
.SH DESCRIPTION
|
|
||||||
.I Barf
|
|
||||||
outputs (on standard output) a collection of debugging information
|
|
||||||
(contents of files, selections from logs, etc.)
|
|
||||||
related to the IPsec encryption/authentication system.
|
|
||||||
It is primarily a convenience for remote debugging,
|
|
||||||
a single command which packages up (and labels) all information
|
|
||||||
that might be relevant to diagnosing a problem in IPsec.
|
|
||||||
.PP
|
|
||||||
.PP
|
|
||||||
The
|
|
||||||
.B \-\-short
|
|
||||||
option limits the length of
|
|
||||||
the log portion of
|
|
||||||
.IR barf 's
|
|
||||||
output, which can otherwise be extremely voluminous
|
|
||||||
if debug logging is turned on.
|
|
||||||
.PP
|
|
||||||
.I Barf
|
|
||||||
censors its output,
|
|
||||||
replacing keys
|
|
||||||
and secrets with brief checksums to avoid revealing sensitive information.
|
|
||||||
.PP
|
|
||||||
Beware that the output of both commands is aimed at humans,
|
|
||||||
not programs,
|
|
||||||
and the output format is subject to change without warning.
|
|
||||||
.PP
|
|
||||||
.I Barf
|
|
||||||
has to figure out which files in
|
|
||||||
.I /var/log
|
|
||||||
contain the IPsec log messages.
|
|
||||||
It looks for KLIPS and general log messages first in
|
|
||||||
.IR messages
|
|
||||||
and
|
|
||||||
.IR syslog ,
|
|
||||||
and for Pluto messages first in
|
|
||||||
.IR secure ,
|
|
||||||
.IR auth.log ,
|
|
||||||
and
|
|
||||||
.IR debug .
|
|
||||||
In both cases,
|
|
||||||
if it does not find what it is looking for in one of those ``likely'' places,
|
|
||||||
it will resort to a brute-force search of most (non-compressed) files in
|
|
||||||
.IR /var/log .
|
|
||||||
.SH FILES
|
|
||||||
.nf
|
|
||||||
/proc/net/*
|
|
||||||
/var/log/*
|
|
||||||
/etc/ipsec.conf
|
|
||||||
/etc/ipsec.secrets
|
|
||||||
.fi
|
|
||||||
.SH HISTORY
|
|
||||||
Written for the Linux FreeS/WAN project
|
|
||||||
<http://www.freeswan.org>
|
|
||||||
by Henry Spencer.
|
|
||||||
.SH BUGS
|
|
||||||
.I Barf
|
|
||||||
uses heuristics to try to pick relevant material out of the logs,
|
|
||||||
and relevant messages
|
|
||||||
which are not labelled with any of the tags that
|
|
||||||
.I barf
|
|
||||||
looks for will be lost.
|
|
||||||
We think we've eliminated the last such case, but one never knows...
|
|
||||||
.PP
|
|
||||||
Finding
|
|
||||||
.I updown
|
|
||||||
scripts (so they can be included in output) is, in general, difficult.
|
|
||||||
.I Barf
|
|
||||||
uses a very simple heuristic that is easily fooled.
|
|
||||||
.PP
|
|
||||||
The brute-force search for the right log files can get expensive on
|
|
||||||
systems with a lot of clutter in
|
|
||||||
.IR /var/log .
|
|
||||||
@@ -1,296 +0,0 @@
|
|||||||
#! /bin/sh
|
|
||||||
# dump assorted information of use in debugging
|
|
||||||
# Copyright (C) 1998, 1999 Henry Spencer.
|
|
||||||
#
|
|
||||||
# This program is free software; you can redistribute it and/or modify it
|
|
||||||
# under the terms of the GNU General Public License as published by the
|
|
||||||
# Free Software Foundation; either version 2 of the License, or (at your
|
|
||||||
# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
|
||||||
#
|
|
||||||
# This program is distributed in the hope that it will be useful, but
|
|
||||||
# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
|
||||||
# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
|
||||||
# for more details.
|
|
||||||
#
|
|
||||||
# RCSID $Id: barf.in,v 1.4 2004/09/23 21:08:23 as Exp $
|
|
||||||
|
|
||||||
IPSEC_NAME="strongSwan"
|
|
||||||
|
|
||||||
KERNSRC=${KERNSRC-/usr/src/linux}
|
|
||||||
LOGS=${LOGS-/var/log}
|
|
||||||
CONFS=${IPSEC_CONFS-/etc}
|
|
||||||
CONFDDIR=${IPSEC_CONFDDIR-/etc/ipsec.d}
|
|
||||||
me="ipsec barf"
|
|
||||||
|
|
||||||
# kludge to produce no barf output mentioning policygroups if none are present.
|
|
||||||
# This will not catch ".file" policygroups.
|
|
||||||
PREPOLICIES=${CONFDDIR}/policies
|
|
||||||
if [ `ls $PREPOLICIES 2> /dev/null | wc -l` -ne 0 ]
|
|
||||||
then
|
|
||||||
POLICIES=$PREPOLICIES
|
|
||||||
fi
|
|
||||||
|
|
||||||
# message patterns that start relevant parts of logs
|
|
||||||
fstart="Starting $IPSEC_NAME"
|
|
||||||
pstart='Starting Pluto subsystem'
|
|
||||||
|
|
||||||
case "$1" in
|
|
||||||
--help) echo "Usage: ipsec barf" ; exit 0 ;;
|
|
||||||
--version) echo "$me $IPSEC_VERSION" ; exit 0 ;;
|
|
||||||
esac
|
|
||||||
|
|
||||||
# make sure output is in English
|
|
||||||
unset LANG LANGUAGE LC_ALL LC_MESSAGES
|
|
||||||
|
|
||||||
# log-location guesser, results in $findlog_file and $findlog_startline
|
|
||||||
# Fine point: startline is the *last* line containing "string", or
|
|
||||||
# failing that, the *first* line containing "fallbackstring".
|
|
||||||
findlog() { # findlog string fallbackstring possiblefile ...
|
|
||||||
s="$1"
|
|
||||||
shift
|
|
||||||
t="$1"
|
|
||||||
shift
|
|
||||||
# try the suggested files first
|
|
||||||
for f in $*
|
|
||||||
do
|
|
||||||
if test -r $LOGS/$f -a -f $LOGS/$f && egrep -q "$s" $LOGS/$f
|
|
||||||
then
|
|
||||||
# aha, this one has it
|
|
||||||
findlog_file=$LOGS/$f
|
|
||||||
findlog_startline=`egrep -n "$s" $LOGS/$f |
|
|
||||||
sed -n '$s/:.*//p'`
|
|
||||||
return 0
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
for f in $*
|
|
||||||
do
|
|
||||||
if test -r $LOGS/$f -a -f $LOGS/$f && egrep -q "$t" $LOGS/$f
|
|
||||||
then
|
|
||||||
# aha, this one has it
|
|
||||||
findlog_file=$LOGS/$f
|
|
||||||
findlog_startline=`egrep -n "$t" $LOGS/$f |
|
|
||||||
sed -n '1s/:.*//p'`
|
|
||||||
return 0
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
# nope, resort to a search, newest first, of uncompressed logs
|
|
||||||
for f in `ls -t $LOGS | egrep -v '^mail' | egrep -v '\.(gz|Z)$'`
|
|
||||||
do
|
|
||||||
if test -r $LOGS/$f -a ! -d $LOGS/$f && egrep -q "$s" $LOGS/$f
|
|
||||||
then
|
|
||||||
# found it
|
|
||||||
findlog_file=$LOGS/$f
|
|
||||||
findlog_startline=`egrep -n "$s" $LOGS/$f |
|
|
||||||
sed -n '$s/:.*//p'`
|
|
||||||
return 0
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
for f in `ls -t $LOGS | egrep -v '^mail' | egrep -v '\.(gz|Z)$'`
|
|
||||||
do
|
|
||||||
if test -r $LOGS/$f -a -f $LOGS/$f && egrep -q "$t" $LOGS/$f
|
|
||||||
then
|
|
||||||
# found it
|
|
||||||
findlog_file=$LOGS/$f
|
|
||||||
findlog_startline=`egrep -n "$t" $LOGS/$f |
|
|
||||||
sed -n '1s/:.*//p'`
|
|
||||||
return 0
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
# echo "$0: unable to find $LOGS/$1 or local equivalent" >&2
|
|
||||||
findlog_file=/dev/null
|
|
||||||
findlog_startline=1 # arbitrary
|
|
||||||
}
|
|
||||||
|
|
||||||
# try to guess where logs are
|
|
||||||
findlog "$fstart" "klips" messages syslog
|
|
||||||
if test " $findlog_file" = " /dev/null"
|
|
||||||
then
|
|
||||||
echo "Unable to find KLIPS messages, typically found in /var/log/messages or equivalent. You may need to run $IPSEC_NAME for the first time; alternatively, your log files have been emptied (ie, logwatch) or we do not understand your logging configuration."
|
|
||||||
fi
|
|
||||||
klog=$findlog_file
|
|
||||||
kline=$findlog_startline
|
|
||||||
|
|
||||||
findlog "$pstart" "Pluto" secure auth.log debug
|
|
||||||
if test " $findlog_file" = " /dev/null"
|
|
||||||
then
|
|
||||||
echo "Unable to find Pluto messages, typically found in /var/log/secure or equivalent. You may need to run $IPSEC_NAME for the first time; alternatively, your log files have been emptied (ie, logwatch) or we do not understand your logging configuration."
|
|
||||||
fi
|
|
||||||
plog=$findlog_file
|
|
||||||
pline=$findlog_startline
|
|
||||||
|
|
||||||
# /lib/modules examiner
|
|
||||||
modulegoo() {
|
|
||||||
set +x
|
|
||||||
for d in `ls /lib/modules`
|
|
||||||
do
|
|
||||||
if test -d /lib/modules/$d
|
|
||||||
then
|
|
||||||
f=/lib/modules/$d/$1
|
|
||||||
if test -f $f
|
|
||||||
then
|
|
||||||
nm -g $f | egrep "$2"
|
|
||||||
else
|
|
||||||
echo
|
|
||||||
fi | sed "s;^;$d: ;"
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
set -x
|
|
||||||
}
|
|
||||||
|
|
||||||
# advanced shell deviousness to get dividers into output
|
|
||||||
_________________________() {
|
|
||||||
$2 # something to do nothing and not echo anything
|
|
||||||
}
|
|
||||||
|
|
||||||
exec 2>&1 # stderr on stdout, so errors go into main output
|
|
||||||
|
|
||||||
hostname ; date
|
|
||||||
set -x
|
|
||||||
_________________________ version
|
|
||||||
ipsec --version
|
|
||||||
_________________________ proc/version
|
|
||||||
cat /proc/version
|
|
||||||
_________________________ proc/net/ipsec_eroute
|
|
||||||
sort -sg +3 /proc/net/ipsec_eroute || cat /proc/net/ipsec_eroute
|
|
||||||
_________________________ netstat-rn
|
|
||||||
netstat -nr
|
|
||||||
_________________________ proc/net/ipsec_spi
|
|
||||||
cat /proc/net/ipsec_spi
|
|
||||||
_________________________ proc/net/ipsec_spigrp
|
|
||||||
cat /proc/net/ipsec_spigrp
|
|
||||||
_________________________ proc/net/ipsec_tncfg
|
|
||||||
cat /proc/net/ipsec_tncfg
|
|
||||||
_________________________ proc/net/pf_key
|
|
||||||
cat /proc/net/pf_key
|
|
||||||
_________________________ proc/net/pf_key-star
|
|
||||||
( cd /proc/net && egrep '^' pf_key_* )
|
|
||||||
_________________________ proc/sys/net/ipsec-star
|
|
||||||
( cd /proc/sys/net/ipsec && egrep '^' * )
|
|
||||||
_________________________ ipsec/statusall
|
|
||||||
ipsec auto --statusall
|
|
||||||
_________________________ ifconfig-a
|
|
||||||
ifconfig -a
|
|
||||||
_________________________ mii-tool
|
|
||||||
if [ -x /sbin/mii-tool ]
|
|
||||||
then
|
|
||||||
/sbin/mii-tool -v
|
|
||||||
elif [ -x /usr/sbin/mii-tool ]
|
|
||||||
then
|
|
||||||
/usr/sbin/mii-tool -v
|
|
||||||
else
|
|
||||||
mii-tool -v
|
|
||||||
fi
|
|
||||||
_________________________ ipsec/directory
|
|
||||||
ipsec --directory
|
|
||||||
_________________________ hostname/fqdn
|
|
||||||
hostname --fqdn
|
|
||||||
_________________________ hostname/ipaddress
|
|
||||||
hostname --ip-address
|
|
||||||
_________________________ uptime
|
|
||||||
uptime
|
|
||||||
_________________________ ps
|
|
||||||
# -i ppid picks up the header
|
|
||||||
ps alxwf | egrep -i 'ppid|pluto|ipsec|klips'
|
|
||||||
_________________________ ipsec/showdefaults
|
|
||||||
ipsec showdefaults
|
|
||||||
_________________________ ipsec/conf
|
|
||||||
ipsec _include $CONFS/ipsec.conf | ipsec _keycensor
|
|
||||||
_________________________ ipsec/secrets
|
|
||||||
ipsec _include $CONFS/ipsec.secrets | ipsec _secretcensor
|
|
||||||
_________________________ ipsec/listall
|
|
||||||
ipsec auto --listall
|
|
||||||
if [ $POLICIES ]
|
|
||||||
then
|
|
||||||
for policy in $POLICIES/*; do base=`basename $policy`;
|
|
||||||
_________________________ ipsec/policies/$base
|
|
||||||
cat $policy
|
|
||||||
done
|
|
||||||
fi
|
|
||||||
_________________________ ipsec/ls-libdir
|
|
||||||
ls -l ${IPSEC_LIBDIR-/usr/local/lib/ipsec}
|
|
||||||
_________________________ ipsec/ls-execdir
|
|
||||||
ls -l ${IPSEC_EXECDIR-/usr/local/libexec/ipsec}
|
|
||||||
_________________________ ipsec/updowns
|
|
||||||
for f in `ls ${IPSEC_EXECDIR-/usr/local/libexec/ipsec} | egrep updown`
|
|
||||||
do
|
|
||||||
cat ${IPSEC_EXECDIR-/usr/local/libexec/ipsec}/$f
|
|
||||||
done
|
|
||||||
_________________________ proc/net/dev
|
|
||||||
cat /proc/net/dev
|
|
||||||
_________________________ proc/net/route
|
|
||||||
cat /proc/net/route
|
|
||||||
_________________________ proc/sys/net/ipv4/ip_forward
|
|
||||||
cat /proc/sys/net/ipv4/ip_forward
|
|
||||||
_________________________ proc/sys/net/ipv4/conf/star-rp_filter
|
|
||||||
( cd /proc/sys/net/ipv4/conf && egrep '^' */rp_filter )
|
|
||||||
_________________________ uname-a
|
|
||||||
uname -a
|
|
||||||
_________________________ redhat-release
|
|
||||||
if test -r /etc/redhat-release
|
|
||||||
then
|
|
||||||
cat /etc/redhat-release
|
|
||||||
fi
|
|
||||||
_________________________ proc/net/ipsec_version
|
|
||||||
cat /proc/net/ipsec_version
|
|
||||||
_________________________ iptables/list
|
|
||||||
iptables -L -v -n
|
|
||||||
_________________________ ipchains/list
|
|
||||||
ipchains -L -v -n
|
|
||||||
_________________________ ipfwadm/forward
|
|
||||||
ipfwadm -F -l -n -e
|
|
||||||
_________________________ ipfwadm/input
|
|
||||||
ipfwadm -I -l -n -e
|
|
||||||
_________________________ ipfwadm/output
|
|
||||||
ipfwadm -O -l -n -e
|
|
||||||
_________________________ iptables/nat
|
|
||||||
iptables -t nat -L -v -n
|
|
||||||
_________________________ ipchains/masq
|
|
||||||
ipchains -M -L -v -n
|
|
||||||
_________________________ ipfwadm/masq
|
|
||||||
ipfwadm -M -l -n -e
|
|
||||||
_________________________ iptables/mangle
|
|
||||||
iptables -t mangle -L -v -n
|
|
||||||
_________________________ proc/modules
|
|
||||||
cat /proc/modules
|
|
||||||
_________________________ proc/meminfo
|
|
||||||
cat /proc/meminfo
|
|
||||||
_________________________ dev/ipsec-ls
|
|
||||||
ls -l /dev/ipsec*
|
|
||||||
_________________________ proc/net/ipsec-ls
|
|
||||||
ls -l /proc/net/ipsec_*
|
|
||||||
_________________________ usr/src/linux/.config
|
|
||||||
if test -f $KERNSRC/.config
|
|
||||||
then
|
|
||||||
egrep 'IP|NETLINK' $KERNSRC/.config
|
|
||||||
fi
|
|
||||||
_________________________ etc/syslog.conf
|
|
||||||
cat /etc/syslog.conf
|
|
||||||
_________________________ etc/resolv.conf
|
|
||||||
cat /etc/resolv.conf
|
|
||||||
_________________________ lib/modules-ls
|
|
||||||
ls -ltr /lib/modules
|
|
||||||
_________________________ proc/ksyms-netif_rx
|
|
||||||
egrep netif_rx /proc/ksyms
|
|
||||||
_________________________ lib/modules-netif_rx
|
|
||||||
modulegoo kernel/net/ipv4/ipip.o netif_rx
|
|
||||||
_________________________ kern.debug
|
|
||||||
if test -f $LOGS/kern.debug
|
|
||||||
then
|
|
||||||
tail -100 $LOGS/kern.debug
|
|
||||||
fi
|
|
||||||
_________________________ klog
|
|
||||||
sed -n $kline,'$'p $klog |
|
|
||||||
egrep -i 'ipsec|klips|pluto' |
|
|
||||||
case "$1" in
|
|
||||||
--short) tail -500 ;;
|
|
||||||
*) cat ;;
|
|
||||||
esac
|
|
||||||
_________________________ plog
|
|
||||||
sed -n $pline,'$'p $plog |
|
|
||||||
egrep -i 'pluto' |
|
|
||||||
case "$1" in
|
|
||||||
--short) tail -500 ;;
|
|
||||||
*) cat ;;
|
|
||||||
esac
|
|
||||||
_________________________ date
|
|
||||||
date
|
|
||||||
@@ -1 +0,0 @@
|
|||||||
calcgoo
|
|
||||||
@@ -1,41 +0,0 @@
|
|||||||
# Makefile for miscelaneous programs
|
|
||||||
# Copyright (C) 2002 Michael Richardson <[email protected]>
|
|
||||||
#
|
|
||||||
# This program is free software; you can redistribute it and/or modify it
|
|
||||||
# under the terms of the GNU General Public License as published by the
|
|
||||||
# Free Software Foundation; either version 2 of the License, or (at your
|
|
||||||
# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
|
||||||
#
|
|
||||||
# This program is distributed in the hope that it will be useful, but
|
|
||||||
# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
|
||||||
# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
|
||||||
# for more details.
|
|
||||||
#
|
|
||||||
# RCSID $Id: Makefile,v 1.1 2004/03/15 20:35:27 as Exp $
|
|
||||||
|
|
||||||
FREESWANSRCDIR=../..
|
|
||||||
include ${FREESWANSRCDIR}/Makefile.inc
|
|
||||||
|
|
||||||
PROGRAM=calcgoo
|
|
||||||
|
|
||||||
include ../Makefile.program
|
|
||||||
|
|
||||||
#
|
|
||||||
# $Log: Makefile,v $
|
|
||||||
# Revision 1.1 2004/03/15 20:35:27 as
|
|
||||||
# added files from freeswan-2.04-x509-1.5.3
|
|
||||||
#
|
|
||||||
# Revision 1.1 2002/06/10 04:27:25 mcr
|
|
||||||
# calcgoo program processes kernel symbol list and generates a
|
|
||||||
# composite value by xor'ing the programmed symbol.
|
|
||||||
#
|
|
||||||
# Revision 1.1 2002/06/10 00:19:44 mcr
|
|
||||||
# rename "ipsec check" to "ipsec verify"
|
|
||||||
#
|
|
||||||
# Revision 1.1 2002/06/08 17:01:25 mcr
|
|
||||||
# added new program "ipsec check" to do rudamentary testing
|
|
||||||
# on a newly installed system to see if it is OE ready.
|
|
||||||
#
|
|
||||||
#
|
|
||||||
#
|
|
||||||
|
|
||||||
@@ -1,31 +0,0 @@
|
|||||||
.TH IPSEC_CALCGOO 8 "8 June 2002"
|
|
||||||
.\" RCSID $Id: calcgoo.8,v 1.1 2004/03/15 20:35:27 as Exp $
|
|
||||||
.SH NAME
|
|
||||||
ipsec calcgoo \- calculate hex value for matching modules and kernels
|
|
||||||
.SH SYNOPSIS
|
|
||||||
.B ipsec
|
|
||||||
.B calcgoo
|
|
||||||
.SH DESCRIPTION
|
|
||||||
.I calcgoo
|
|
||||||
accepts the output of
|
|
||||||
.B nm -ao
|
|
||||||
or
|
|
||||||
.B /proc/ksyms
|
|
||||||
and extracts a release dependant list of symbols from it. The symbols
|
|
||||||
are processed to extract the values assigned during the MODVERSIONS
|
|
||||||
process. This process makes sure that Linux modules are only loaded
|
|
||||||
on matching kernels.
|
|
||||||
.P
|
|
||||||
This routine is used to find an appropriate module to match the currently
|
|
||||||
running kernel by _startklips.
|
|
||||||
.SH FILES
|
|
||||||
.nf
|
|
||||||
/proc/ksyms
|
|
||||||
.fi
|
|
||||||
.SH "SEE ALSO"
|
|
||||||
ipsec__startklips(8), genksyms(8)
|
|
||||||
.SH HISTORY
|
|
||||||
Written for the Linux FreeS/WAN project
|
|
||||||
<http://www.freeswan.org>
|
|
||||||
by Michael Richardson.
|
|
||||||
.SH BUGS
|
|
||||||
@@ -1,43 +0,0 @@
|
|||||||
#!/usr/bin/perl
|
|
||||||
|
|
||||||
$MODULE_GOO_LIST="@MODULE_GOO_LIST@";
|
|
||||||
|
|
||||||
@goo = split(/\s+/,$MODULE_GOO_LIST);
|
|
||||||
|
|
||||||
$sep="(";
|
|
||||||
$goore=" ";
|
|
||||||
|
|
||||||
#print "GOO: ",join('|',@goo),"\n";
|
|
||||||
|
|
||||||
foreach $sym (@goo) {
|
|
||||||
$goore=${goore}.${sep}.${sym};
|
|
||||||
$sep="|";
|
|
||||||
}
|
|
||||||
$goore=${goore}.")_R(smp_){0,1}([0-9A-F]{8})";
|
|
||||||
|
|
||||||
#print "GOORE: $goore\n";
|
|
||||||
|
|
||||||
while(<>) {
|
|
||||||
chomp;
|
|
||||||
if(/$goore/io) {
|
|
||||||
$sym=$1;
|
|
||||||
$goosym=$3;
|
|
||||||
$bingoo=hex($goosym);
|
|
||||||
if($2 eq "smp_") {
|
|
||||||
$bingoo++;
|
|
||||||
}
|
|
||||||
#print STDERR "Processing $goosym (from $_)\n";
|
|
||||||
$bingoo{$sym}=$bingoo;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
$wholegoo=0;
|
|
||||||
foreach $sym (keys %bingoo) {
|
|
||||||
$wholegoo=$wholegoo ^ $bingoo{$sym};
|
|
||||||
}
|
|
||||||
print sprintf("%08x", $wholegoo)."\n";
|
|
||||||
|
|
||||||
# Local variables::
|
|
||||||
# mode: perl
|
|
||||||
# End variables::
|
|
||||||
|
|
||||||
|
|
||||||
Reference in New Issue
Block a user